Change Password

Change your own password, having proved you know the current one.

Returns a REPLACEMENT token. That is not a convenience, it is required: setting password_changed_at revokes every token issued before it, and the caller's own token was issued before it. Without a fresh one the user is signed out by their own successful password change — and on the very next request, so it reads as the change having failed.

The one-second backdate is for the same machinery. iat is whole seconds (jwt encodes an int), and the check in auth_service is token_time < password_changed_at. Mint the replacement in the same wall-clock second as the change and the truncated iat can land a fraction BEFORE password_changed_at, revoking the token we just issued. Backdating the stamp by a second puts every genuinely-old token on the revoked side and the new one safely on the live side.